spring-boot - 基于 url 的自定义多个身份验证提供程序始终仅调用一个提供程序

Question

我已经配置了多个自定义auth providers，使用auth2和spring boot，但它总是执行CustomInternalAuthenticationProvider唯一的。你能解释一下如何按顺序应用蚂蚁匹配器规则吗？我使用了两个WebSecurityConfigurerAdapter类，一个是有序的，一个是默认的。指导我如何处理规则antmatcher正确吗？

@EnableResourceServer
@EnableWebSecurity
public class WebSecurityConfig{

    @Autowired
    UserDetailsService userDetailsService;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }


    @Configuration
    @Order(1)
    public static class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter{

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            System.out.println("@order");
                      http.antMatcher("/../main/**")
                      .requestMatchers()
                      .antMatchers("/","/login*", "/oauth/authorize**","/exit","**/logout")

                  .and().authenticationProvider(daoInternalAuthenticationProvider())
                   .formLogin().loginPage("/login")

                ;
        }

        @Bean
        public AuthenticationProvider daoInternalAuthenticationProvider() throws Exception {

            return new CustomInternalAuthenticationProvider();
        }

    }

    @Configuration
    public static class ApiTokenSecurityConfig extends WebSecurityConfigurerAdapter{

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            System.out.println("default");

                  http.antMatcher("/../user/**")
                      .requestMatchers()
                      .antMatchers("/","/login*", "/oauth/authorize**","/exit","**/logout")


                          .and() .authenticationProvider(daoExternalAuthenticationProvider())
               .formLogin().loginPage("/login")

               ;


        }

        @Bean
        public AuthenticationProvider daoExternalAuthenticationProvider() throws Exception {

            return new CustomExternalAuthonticationProvider();
        }






    }

标签： spring-bootspring-securityoauth-2.0spring-security-oauth2